CVE-2026-56679
2026-07-15
21h16 +00:00
21h16 +00:00
指定 CVE 通知
随时了解指定 CVE 的变更。
CVE 描述
9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist, allowing an authenticated user to set security-critical fields such as requireLogin and disable authentication for the whole application, exposing protected routes such as /api/keys and /api/providers to unauthenticated access. This issue is reported as fixed in version 0.5.4.
CVE 信息
相关弱点
| 弱点名称 | 来源 | |
|---|---|---|
| Improperly Controlled Modification of Dynamically-Determined Object Attributes The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified. |
